Forensic Trace Report: 800,000 USDT (TRC20) Payment

Automated on-chain trace of a disputed stablecoin payment, with entity attribution and cash-out mapping.

1 · Executive Summary

On 2026-03-16 at 15:13:36 UTC the claimant sent 800,000 USDT from wallet TAspWeMkSMqK5f1wJNvTKT1u2PVookBgzP to TKtdcqumx3wK4FkxuThjPjJPPgRamsh5X4 (tx 987b598b387b4b6d77205f3a68aafe5fa0a8f0458a9488d8217f097f9dbfc852).

1. The wallet received the full 800,000 USDT (plus a 10 USDT test at 15:04).
2. 55 minutes later (16:08 UTC) the entire 800,000 was forwarded in a single transaction to TXrSfNzsbgnPHLsNAAXaajPgfjfrtBWnBX (tx 19cb88874fea6153a3c1d905b7e2f48a60d1c92b385e7fa04c6d18e92b57f3ac).
3. A second payment of 20,000 USDT on 2026-03-17 followed the identical route on 03-18.
4. The receiving wallet holds ~10 USDT today and is otherwise unused — a dedicated receiving address.

The funds entered a high-volume money-moving network (millions of USDT in throughput) that layered the money through 15+ wallets. At least 160,000 USDT reached Binance (tagged Binance-Hot 7), meaning Binance holds KYC identity for the depositing account. The remainder dispersed to at least nine payout wallets via TRON's GasFree relay, in a pattern consistent with an OTC or underground money-service desk.

2 · Case Metadata & Scope

Scope. This report establishes the on-chain movement of the subject funds and the service-level identity of the venues they reached. It does not identify natural persons; account-holder identity behind exchange deposits is obtainable only from the exchange via a law-enforcement request (§10, step 3).

3 · Methodology & Data Sources

• Data sources. TronGrid full-node API and TronScan indexed explorer (public, no privileged access), block range 80,998,000–84,412,000; Ethereum branch from public JSON-RPC and Etherscan. All inputs are public chain data — any party can re-derive every figure.
• Exact tracing (hops 0–2). Where an address forwards the full received amount in discrete transactions, hops are joined 1:1 by transaction hash — deterministic, marked EXACT.
• Attribution (hops 3–4). Past the first commingling point, subject funds are followed by timing-and-amount proximity within the receiving wallet's flow — the standard method used by exchanges and law enforcement where strict FIFO cannot apply. Marked ATTRIBUTED; not a cryptographic guarantee (§5 caveat).
• Entity attribution. Exchange and service labels come from deposit-address clustering, service registries, and observed hot-wallet behavior, each tag carrying its source and date. Attribution is service-level, never person-level.
• Cross-chain joins. Bridge crossings are matched by lock/mint timing and amount. Such joins are marked candidate and require corroboration from the bridge operator's records before evidentiary use (§6).
• Quality controls. Address-poisoning filter (2 look-alike dust senders excluded, §7); value floor of 100 USDT for table inclusion; narrative sections machine-validated so every address, amount, and hash appears verbatim in the underlying trace data.

4 · Fund Flow

Rendered to scale from the trace snapshot — ribbon width ∝ USDT amount. Hops 0–2 deterministic (exact tx joins) · hops 3–4 attributed · dashed = heuristic bridge candidate. Full transaction detail in §5 · verification steps in §12.

5 · Hop-by-Hop Movement

Hop 0 — Payments into TKtdcqumx3wK4FkxuThjPjJPPgRamsh5X4

Hop 1 — Full forward to the mule hub EXACT

Hop 2 — Four-way split within 20 minutes ATTRIBUTED

Total split: 798,474 USDT. A further 4,000 went to TQGuD1gGmoZ4Fk1rDLmnW6cvL7cW1Qh2AN the same evening.

Hop 3 — Convergence on the collection wallet ATTRIBUTED

Most branches converge on TJoHzotyxrTx5aJpRhEGMphBneEfJf6D2Z ("main collection"):

Hop 4 — Cash-out fan (via GasFree relay) ATTRIBUTED

These payout wallets trade constantly with tagged exchange hot wallets: Binance-Hot 3/4/6/7/9/10/11 Bybit OKX-Hot 8 KuCoin 4. The operators clearly hold accounts at these exchanges.

6 · Cross-Chain Branch CANDIDATE

On 2026-03-20 at 08:31 UTC, 120,000 USDT left the collection wallet into the Allbridge bridge pool. Thirteen minutes later, 119,940 USDT (the amount net of bridge fee) was minted on Ethereum to 0x9fE3b8C4a71D25E6f08c3D91a4B7e5F2c6A8d310, which forwarded 119,900 to HTX deposit addresses in two transactions (03-21, 03-22).

7 · Network Assessment

• The receiving address was purpose-made for this payment — no other activity, near-zero balance now.
• The forwarding hub and split layer are long-running wallets (active since 2025, still active Aug 2026) moving 5- and 6-figure sums weekly among a fixed circle — consistent with a professional laundering or unlicensed money-service operation. TFcXszuFuGYJ6od9W2RvtozkbayHN7Mic7 alone has handled single transfers up to 2,270,000 USDT.
• Payouts use the GasFree relay (no TRX needed, harder to link a funding wallet), each paired with a 1 USDT marker to TLntW9Z59LqY2mKq4w8CtGmXhRhEG7pDsN.
• The cluster is polluted by third-party address-poisoning bots (look-alike addresses sending dust, e.g. TCa9oghXWjwQVtL32fdEBq6v3ff8Bq3FvU mimicking TCa9oFvWnGJdWjwQVtL32fdEBq6v3f8FvU). These were identified and excluded.

8 · Parties & Key Addresses

A directory of every material address in this case, for citation in filings and requests. Roles are on-chain roles, not identities.

9 · Timeline of Key Events

10 · Recommended Actions (in order)

1. File a police / cybercrime report now. Every downstream step needs a case number. Attach this report and the three transaction hashes.
2. Report to Tether's T3 Financial Crime Unit (t3fcu.com). Tether can freeze USDT at contract level on TRON; 800,000 is well above their threshold. Some traced wallets may still hold freezable funds.
3. Law-enforcement requests to exchanges: Binance first (160,000 confirmed to Binance-Hot 7 on 03-22 and 03-27 from TM1M1SZ9kDepoAcct4Y7B6VNXhRq4w8CtZ), then Bybit, OKX, KuCoin. Exchanges act on law-enforcement requests, not victim emails — hence step 1.
4. Preserve off-chain evidence about the person who supplied the address: chats, invoices, identities, phone numbers, bank accounts.
5. Ignore "recovery agents" who promise fund recovery for an upfront fee — that is a follow-up scam targeting victims.

11 · Key Evidence References

All addresses and hashes can be opened directly on tronscan.org.

12 · How to Verify This Report

This report contains no private data — every fact is public chain data any party can re-derive independently, without RoxCustody:

1. Open tronscan.org and paste the root transaction hash from §2. Confirm sender, recipient, amount (800,000 USDT), and timestamp (2026-03-16 15:13:36 UTC) match §1.
2. Open the recipient address and view its Transfers tab: the 55-minute forward of §5 hop 1 appears there, with its own hash.
3. Repeat for each row of the §5 hop tables — every row corresponds to one or more on-chain transactions at the stated times and amounts.
4. Verify the Ethereum branch (§6) on etherscan.io using the mint transaction hash; note it is a candidate join and treat it per the §6 confidence note.
5. Exchange attribution (Binance-Hot 7 and others) can be confirmed authoritatively by the exchange itself in response to a law-enforcement request; the deposit transactions in §11 identify the exact account activity to ask about.

The snapshot underlying this report is immutable: regenerating the report from the same snapshot reproduces it byte-for-byte, and the labels-as-of date (§2) fixes the entity-label state used.

13 · Glossary (for non-specialist readers)